Legality of scanning a site with SSLLabs SSL Server Test in order to find and report weaknesses

Question

I am wanting to scan a site (which I do not own) to see if they are vulnerable to anything like Heartbleed or the POODLE attack, not because I want to exploit any such vulnerabilities for malicious purposes, but because I want to inform the site owner of any possible vulnerabilities in their site which may need to be looked into.

But what is the legality of using the SSLLabs SSL Server Test to determine if there are any vulnerabilities in the site (in order to report them) without the site owner's prior permission? As I understand that certain more intrusive scans are only legal with the prior permission of the site owner, I also understand that attempting to detect whether a site is, say, vulnerable to Hearbleed or not can have some legal issues. So is it legal for me to scan a site with this tool in order to report any weaknesses to the site owner, or should I seek prior permission from them first? I am in the UK, but the site that I want to scan is hosted in the US.

Answer 1

If you have a business agreement with the website owner ensure the business agreement authorises you to responsibly conduct periodic security assessments in order to identify vulnerabilities which if found would then be responsibly disclosed only to them and via a secure communication. If they agree to this then you would be protected for the activities you have described.

If you don't have a business agreement with the website owner they may not welcome for you to scan first and introduce yourself later, and they could respond as though you pose a threat. Scanning for vulnerabilities if not authorised in advanced could be reported to the police as an offence under the Computer Misuse Act in the UK or the Computer Fraud and Abuse Act in the US. While the police may or may not follow-up, and a prosecution may or may not result, it's always best not to let things get this far!

While the legislation and consequences can differ between UK and US, the much safer route is always to get permission first.

An even safer route is for you to contact them, introduce yourself and invite them to scan their own website, and if vulnerable contact you for assistance to implement the solution (assuming you might provide such a service). You cannot be liable if they have scanned their own website.